Hasura GraphQL Engine v2.49.4 – New WebSocket Queue, Idempotent Migrations, and CLI Enhancements

by

What’s new in Hasura GraphQL Engine v2.49.4

This patch release (officially announced on the Hasura GitHub releases page) focuses on stability and operational safety.

Server‑side improvements

  • Idempotent catalog and Postgres source migrations – All ADD COLUMN statements now include IF NOT EXISTS, preventing failures when a migration has already been applied but its version wasn’t recorded. (vendor claim)
  • Bounded WebSocket queue – New environment variable HASURA_GRAPHQL_WEBSOCKET_QUEUE_SIZE caps the internal send queue at 100 messages by default. When the limit is hit, the oldest message is dropped. This mitigates unbounded memory growth caused by very slow or long‑lived clients. Metrics hasura_websocket_messages_queued_total and hasura_websocket_messages_evicted_total expose queue activity. (vendor claim)
  • Header deprecation – The long‑deprecated X-Hasura-Access-Key header is no longer accepted; clients should use X-Hasura-Admin-Secret instead. (vendor claim)
  • Extra JWT claim validation – An extra_required_claims option lets administrators enforce that a JWT contains specific issuer and/or audience fields when those are configured. By default the validation is permissive, so enabling this option tightens security for self‑hosted identity providers. (vendor claim)

CLI enhancements

  • New command: hasura metadata apply-data-sources – Applies only the data‑source connection configuration from project metadata, leaving existing tracked tables untouched. It is idempotent and non‑destructive, enabling teams to provision data sources before running database migrations, thereby avoiding a window where metadata could expose non‑existent tables. (vendor claim)

Why these changes matter

Idempotent migrations reduce manual recovery steps after partial rollout failures. The bounded WebSocket queue protects server memory in high‑latency client scenarios, a common concern for real‑time dashboards. Tightening JWT validation helps organisations meet stricter compliance requirements, while the new CLI command streamlines CI/CD pipelines that separate schema migration from metadata application.

For the full changelog, see the official release page.